1 / 57

Chapter 3

Chapter 3. Enumeration. Last modified 1-30-09. Definition. Scanning identifies live hosts and running services Enumeration probes the identified services more fully for known weaknesses Enumeration is more intrusive, using active connections and directed queries

cais
Télécharger la présentation

Chapter 3

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Chapter 3 Enumeration Last modified 1-30-09

  2. Definition • Scanning identifies live hosts and running services • Enumeration probes the identified services more fully for known weaknesses • Enumeration is more intrusive, using active connections and directed queries • Enumeration will usually be logged and noticed

  3. Goals of Enumeration • User account names • to inform subsequent password-guessing attacks • Oft-misconfigured shared resources • for example, unsecured file shares • Older software versions with known security vulnerabilities • such as web servers with remote buffer overflows

  4. Pen-Test Video • Link Ch 3a: Droop's Box: Simple Pen-test Using Nmap, Nikto, Bugtraq, Nslookup and Other Tools by IronGeek

  5. Telnet in Vista and Windows 7 • First you need to install Telnet • In Control Panel, Programs and Features, Turn Windows Features on or off, check Telnet Client

  6. Banner Grabbing • Connecting to remote applications and observing the output • Simple way, at a command prompt • telnet www.ccsf.edu 80 • On the next blank screen type in • GET / HTTP/1.1 • Press Enter twice

  7. Making Characters Visible • In Windows XP and Vista, you can't see what you type in the Telnet session • Do this: • At a command prompt, type • telnet hills.ccsf.edu 80 • Press Enter. Press Ctrl+]. Then type • set localecho • Press Enter twice • Link Ch 3z11

  8. Example Banners • www.ccsf.edu tells you too much • cnn.com is better

  9. Netcat Banner Grabs • Get Netcat for Windows at links Ch 3d, 3d1, 3d2

  10. Banner-Grabbing Countermeasures • Turn off unnecessary services • Disable the presentation the vendor and version in banners • Audit yourself regularly with port scans and raw netcat connects to active ports

  11. Enumerating Common Network Services • FTP Enumeration, TCP 21 • Enumerating SMTP, TCP 25 • DNS Zone Transfers, TCP 53 • Enumerating TFTP, TCP/UDP 69 • Finger, TCP/UDP 79 • Enumerating HTTP, TCP 80

  12. FTP Enumeration, TCP 21 • CCSF doesn't give away much information • FTP is becoming obsolete, see ftp.sun.com • FTP passwords are sent in the clear • Don't allow anonymous uploads • Turn it off, use secure FTP instead

  13. Googling for FTP Servers • Search for • intitle:"Index of ftp://" • Here's an overly informative HTTP banner

  14. FTP Banner • Here's the corresponding overly informative FTP banner

  15. Enumerating SMTP, TCP 25 • SMTP can be enumerated with Telnet, using these commands • VRFY confirms names of valid users • EXPN reveals the actual delivery addresses of aliases and mailing lists

  16. Antivirus Note • McAfee antivirus blocks telnets to port 25 • "Prevent mass mailing worms from sending mail"

  17. SMTP Enumeration Countermeasures • Disable the EXPN and VRFY commands, or restrict them to authenticated users • Sendmail and Exchange both allow that in modern versions

  18. DNS Zone Transfers, TCP 53 • Zone transfers dump the entire contents of a given domain's zone files • Restricted to authorized machines on most DNS servers now

  19. Enumerating TFTP, TCP/UDP 69 • TFTP is inherently insecure • Runs in cleartext • No authentication at all • Anyone can grab any file • Used in routers and VoIP Telephones to update firmware

  20. TFTP Enumeration Countermeasures • Wrap it to restrict access • Using a tool such as TCP Wrappers • TCP Wrappers is like a software firewall, only allowing certain clients to access a service • Links Ch 3e, 3f • Limit access to the /tftpboot directory • Make sure it's blocked at the border firewall

  21. Finger, TCP/UDP 79 • Shows users on local or remote systems, if enabled • Useful for social engineering • Countermeasure: block remote access to finger

  22. Enumerating HTTP, TCP 80 • Grab banners with netcat or telnet • Crawl Web sites with Sam Spade

  23. HTTP Enumeration Countermeasures • Change the banner on your web servers • URLScan for IIS v 4 and later • Link Ch 3h

  24. Microsoft RPC Endpoint Mapper (MSRPC), TCP 135 • Remote Procedure Call (RPC) endpoint mapper (or portmapper) service on TCP 135 • Querying this service can yield information about applications and services available on the target machine

  25. epdump • Shows services bound to IP addresses • It takes some research to interpret the results • Link Ch 3n

  26. rpcdump • On the Backtrack 2 CD • Start, Backtrack, Vulnerability Identification, All, RPCDump • Similar confusing results

  27. rpcdump Results

  28. MSRPC Enumeration Countermeasures • Block port 135 at the firewall, if you can • But some Microsoft Exchange configurations require access to the endpoint mapper • You can avoid that by using Virtual Private Networks, or • Outlook Web Access (OWA) which works over HTTPS

  29. NetBIOS Name Service, UDP 137 • NetBIOS Name Service (NBNS) is Microsoft's name service, an alternative to DNS • What is Name Resolution? • Suppose you issue a command that refers to a computer by name, such as PING

  30. Name Resolution • Windows needs to change a computer name to an IP address to send data packets • Windows uses two naming systems: • DNS (the preferred method) • NetBIOS Name Resolution (still used by all versions of Windows) • See link Ch 3v

  31. Standard Name Resolution Methods • Charts from link Ch 3v

  32. Additional Name Resolution Methods

  33. NET VIEW • NET VIEW can list the domains, or the computers in each domain

  34. NBNS over TCP/IP • Normally NBNS only works on the local network segment • It is possible to route NBNS over TCP/IP, allowing enumeration from a remote system

  35. Other Tools to Enumerate NBNS • NLTEST and NETDOM can find domain controllers • NETVIEWX finds specific services • NBTSTAT collects information from a single system • NBTSCAN scans a whole range of addresses, and dumps the whole NetBIOS name table • Link Ch 3w

  36. NBTSCAN

  37. Stopping NetBIOS Name Services Enumeration • All the preceding techniques operate over the NetBIOS Naming Service, UDP 137 • Block UDP 137 at the firewall, or restrict it to only certain hosts • To prevent user data from appearing in NetBIOS name table dumps, disable the Alerter and Messenger services on individual hosts • Blocking UDP 137 will disable NBNS name authentication, of course

  38. NetBIOS Session, TCP 139 • These are the notorious Null Sessions • The Windows Server Message Block (SMB) protocol hands out a wealth of information freely • Null Sessions are turned off by default in Win XP and later versions, but open in Win 2000 and NT • They aren't available in Win 95, 98, or Me • Link Ch 3x, 3y, 3z00, 3z01

  39. Null Session Against Win 2000

  40. Information Available • Null sessions on Win 2000 and NT provide information about: • Shares • User accounts • Password policies

  41. DumpSec • Free from link Ch 3z02 • Runs on Vista (and earlier Windows)

  42. Registry Enumeration • The Registry can be viewed remotely • Requires Administrator privileges by default on Windows servers • You can't do it with null sessions • Gary McKinnon used remote registry access to hack into the Pentagon • Link Ch 3z03

  43. user2sid/sid2user • These utilities can get user account names and SIDs remotely, even if the registry key RestrictAnonymous is set to 1 • They can find the Administrator's account name, even if it's renamed, by changing the last 3 numbers of another account's SID to 500 • Works against Win 2003, but not Win XP SP2 • See link Ch 3z04

  44. All-in-One Null Session Enumeration Tools • Winfo • Newer tool: • NBTEnum 3.3 • Link Ch 3z15

  45. SMB Null Session Countermeasures • Block TCP 139 and 445 at the router • Set the RestrictAnonymous registry key to 1 or 2 • HKLM\SYSTEM\CurrentControlSet\Control\LSA • Ensure the Registry Is Locked Down • http://support.microsoft.com/kb/153183 (link Ch 3z16)

  46. SNMP, UDP 161 • Simple Network Management Protocol (SNMP) is intended for network management and monitoring • Administrators use SNMP to remotely manage routers and other network devices • But it has many security vulnerabilities • See links Ch 3z06, 3z07, 3z08

  47. Community Strings • SNMP is not a very secure protocol. • It has a minimal security system called SNMP Community Strings • Community strings act like passwords • There are three kinds of SNMP Community strings: Read-Only, Read-Write, and Trap (Trap is rarely used) • But the community strings are often left at obvious defaults like "public" and "private"

  48. Management Information Bases (MIBs) • The MIB contains a SNMP device's data in a tree-structured form, like the Windows Registry • Vendors add data to the MIB • Microsoft stores Windows user account names in the MIB • Image from link Ch 3z07

  49. Data Available Via SNMP Enumeration • Running services • Share names • Share paths • Comments on shares • Usernames • Domain name

  50. SNMP Enumeration Tools • snmputil from the Windows NT Resource Kit • snmpget or snmpwalk for Unix • IP Network Browser • Part of the Engineer's Toolset, link Ch 2d

More Related